- NANOG - lists.nanog.org

Is anyone aware of recent by-protocol traffic data in the public domain?
by Alexander Harrowell 05 Dec '07

05 Dec '07

Excellent public studies of Internet traffic by protocol exist from NSFNet times up to 2002 or 2003; we thank Odlyzko, Claffy et al for their work. However, has anyone else noticed a serious lack of data after the end of the studies summarised in "Longitudinal study of Internet traffic 1998-2003", Fomenkov, Keys, Moore & Claffy, 2003? (This has been discussed in the past, I think.) All that seems to be available is vendor handwaving of the sort Andy Odlyzko takes so much trouble to debunk; and that without any source data. Curiously, no-one seems to be funding this stuff in Europe, either. Alexander Harrowell

4 3

Oregon storms affect trans-pacific traffic
by Sean Donelan 04 Dec '07

04 Dec '07

http://www.theaustralian.news.com.au/story/0,25197,22869272-15306,00.html Southern Cross Cable operations vice president, Dean Veverka, has confirmed that hurricane-strength storms and flooding have wiped out the carrier's Oregon cable route and halved its bandwidth between Australian and the US. Southern Cross's customers in Australia include iiNet, Internode and AAPT.

6 5

Re: [dns-operations] Web Proxy Auto-Discovery (WPAD) Information Disclosure (fwd)
by Gadi Evron 04 Dec '07

04 Dec '07

I was told I should care about smaller entities that ccTLDs on this, so here is a forward to NANOG of a discussion on DNS-operations. ---------- Forwarded message ---------- Date: Tue, 4 Dec 2007 00:56:51 -0600 (CST) From: Gadi Evron <ge(a)linuxbox.org> To: Rickard Dahlstrand <rickard.dahlstrand(a)iis.se> Cc: dns-operations(a)mail.oarc.isc.org Subject: Re: [dns-operations] Web Proxy Auto-Discovery (WPAD) Information Disclosure On Tue, 4 Dec 2007, Rickard Dahlstrand wrote: > Gadi Evron wrote: >> http://www.microsoft.com/technet/security/advisory/945713.mspx >> >> A malicious user could host a WPAD server, potentially establishing it as >> a proxy server to conduct man-in-the-middle attacks against customers >> whose domains are registered as a subdomain to a second-level domain >> (SLD). For customers with a primary DNS suffix configured, the DNS >> resolver in Windows will attempt to resolve an unqualified .wpad. hostname >> using each sub-domain in the DNS suffix until a second-level domain is >> reached. For example, if the DNS suffix is corp.contoso.co.us and an >> attempt is made to resolve an unqualified hostname of wpad, the DNS >> resolver will try wpad.corp.contoso.co.us. If that is not found, it will >> try, via DNS devolution, to resolve wpad.contoso.co.us. If that is not >> found, it will try to resolve wpad.co.us, which is outside of the >> contoso.co.us domain. >> > Most of the wpad.tld domains are already reserved like this one > http://wpad.com/ It's amazing that when they fixed it for .com etc. a > while back they missed that there where two-level tld-domains. > > Rickard. > http://www.microsoft.com/technet/security/bulletin/fq99-054.mspx ----- What's the problem with the search algorithm? When IE 5 starts, it will begin searching for a WPAD server, if it is configured to use WPAD. It starts the search by adding the hostname "WPAD" to current fully-qualified domain name. For instance, a client in a.b.Microsoft.com would search for a WPAD server at wpad.a.b.microsoft.com. If it could not locate one, it would remove the bottom-most domain and try again; for instance, it would try wpad.b.microsoft.com next. IE 5 would stop searching when it found a WPAD server or reached the third-level domain, wpad.microsoft.com. The algorithm stops at the third level in order to not search outside of the current network. However, for international sites, this is not sufficient, because third-level domains can be outside the current network. For example, if the network at xyz.com.au did not have a WPAD server, the search algorithm eventually would reach wpad.com.au, which is an external network name. If the owner of wpad.com.au set up a WPAD server, he or she could provide chosen proxy server configuration settings to the clients at xyz.com.au. For that matter, any network in com.au that didn't have its own WPAD server but did have WPAD enabled in its web clients also would also resolve to wpad.com.au. ----- >From the FAQ for the 1999 fix... It is quite possible, and we can assume (until someone tells us they know), that they fixed it for ccTLDs as well, and then re-introduced the flaw somehow. Also: http://www.wlug.org.nz/WPAD ----- (BeauButler?: I have registered wpad.co.nz, and do not intend to be 'really nasty'. I am collecting the 404 logs with the intention to produce some nice charts, hoever. Also, the wpad organisational-boundaries bug appears to have resurfaced in Internet Explorer 7!!) ----- Beau Bulter is the guy who got all the press by talking about this at kiwicon last week: https://kiwicon.org/presentations#oddy This is the story that got Microsoft's attention: http://www.theage.com.au/news/technology/flaw-leaves-microsoft-looking-like… Which is where Beau says there are ~160,000 exploitable machines in NZ alone. He would *supposedly* know since he has the wpad.co.nz domain. Whether it is a major issue or not, misconfigurations happens, heck, shit happens. I'd think we should watch for this and get that domain registered/monitored at different ccTLDs. Gadi.

2 1

IPv4 BGP Table Reduction Analysis - Prefixes Filter by RIRs Minimum Allocations Boundaries
by Eduardo Ascenco Reis 04 Dec '07

04 Dec '07

Nanog Fellows, I would like to share a work that may be of interest to some of you. Although the BGP data is around one month old and the original focus was on Brazilian AS and IP prefixes, the general analysis covers all Regional Internet Registries (RIRs). This work is part of an IPv4 BGP table reduction analysis and it is about IP prefixes filter by RIRs minimum allocations boundaries methodology (a well discussed Thread - Jon Lewis, et al). The analysis uses BGP data from University of Oregon Route Views Archive Project (2007-10-23-2000) and estimate possible impacts considering suboptimal routing and unreachable destinations. The methodology shows a good efficiency (around 40%) reducing BGP table size, but the estimated number of affect prefixes are also high (around 30%). The report covers impact analysis per RIR and IP prefixes distribution. It also do some IP prefixes accounting and analyse each RIR contribution to BGP table size. Here is the brief report URL: http://www.intron.com.br/doc/bgp/gter24-en-summary.eascenco.bgp-table-red.r… Any comments or suggestions (list or private) are welcome. Eduardo Ascenço Reis <eduardo(a)intron.com.br>

6 8

ATIS releases standard outage classification
by Sean Donelan 04 Dec '07

04 Dec '07

http://www.atis.org/PRESS/pressreleases2007/120307.htm In accordance with the Standard Outage Classification, telecommunication companies can now use common terminology and reporting structures to collect and report data used for identifying causes of outages. If you are not an ATIS member, a copy of the standard is $68. Nevertheless, I suspect media relation professionals for the companies will probably continue to use other euphemisms when discussing SNAFUs with the press.

1 0

RE: Is anyone aware of recent by-protocol traffic data in the public domain?
by Joe St Sauver 04 Dec '07

04 Dec '07

Alexander asked: #Excellent public studies of Internet traffic by protocol exist from NSFNet #times up to 2002 or 2003; we thank Odlyzko, Claffy et al for their work. # #However, has anyone else noticed a serious lack of data after the end of the #studies summarised in "Longitudinal study of Internet traffic 1998-2003", #Fomenkov, Keys, Moore & Claffy, 2003? (This has been discussed in the past, #I think.) All that seems to be available is vendor handwaving of the sort #Andy Odlyzko takes so much trouble to debunk; and that without any source #data. Recognizing that Internet2's traffic is likely significantly different than typical so-called tier-1 providers, you may still be interested in the weekly Internet2 Netflow reports available at: http://netflow.internet2.edu/weekly/ Regards, Joe

1 0

Request for input: ISP tools
by Pete Templin 04 Dec '07

04 Dec '07

List, I'm compiling a tutorial (or series thereof) for small-medium ISPs, covering the gotchas we've all experienced one way or another. As I build the framework, I'm looking for community input in two categories: 1) Tools - What home-grown tool gave your network operations a great leap forward? I'd appreciate hearing about the concept and the result. Bonus points if it's something you can package and make available, or provide a framework for others to build. 2) Requests - What tool do you wish you had? What lesson have you learned, but you haven't managed to automate your way around it? Please unicast your responses to petelists(a)templin.org - summaries to be found at a NANOG near you* * in varying definitions of 'near'... Pete

1 0

BGP community attribute taxonomy
by Benoit Donnet 04 Dec '07

04 Dec '07

Dear Nanog community, During the past years, we have seen an increasing usage of the BGP community attribute. For instance, in a recent BGP table dump from routeviews, 99% of the routes stored by the router carries BGP communities. In this context, we are currently working on a BGP community taxonomy, i.e., we want to classify and document communities according to their usage. We describe our taxonomy on the following url: http://inl.info.ucl.ac.be/communities Based on this taxonomy, we tried to collect as much as possible information on BGP communities. This was a daunting task as we mainly relied on public database, such as whois server and ISP web sites. Our current database of classified BGP communities currently contains more than 12,000 entries. When running our database and taxonomy on recent BGP table dumps from RouteViews and RIPE (last dump from September 2007), we were only able to classify, on average, 20% of the encountered communities. Based on this result, we ranked the unclassified BGP communities. Here is the top 10 of most seen ASes using uncommented communities: AS19151 AS3549 AS3549 AS2914 AS7473 AS286 AS3292 AS13237 AS6667 AS34225 You can find the top 100 on the following url: http:// www.info.ucl.ac.be/~donnet/communities.html It gives the AS number as well as, for each AS, the various unclassified communities and their total frequency (i.e., the number of times the AS with unrecognized communities is encountered in table dumps). If you have any documentation regarding these communities, it would be very helpful if you can send us back this information. The easiest way for you is probably to reply to this email and attach the information (text, PDF, doc file, ...). When our database will be enough representative of the used BGP communities, we will made it freely available. We will also propose a way for updating (adding or removing) BGP communities information in our database. Thanks in advance. Best regards. Dr. Benoit Donnet & Prof. Olivier Bonaventure -- Dr. Benoit Donnet Université Catholique de Louvain (UCL) Faculté des Sciences Appliquées - Département d'Ingénierie Informatique (INGI) Place Sainte Barbe, 2 1348 Louvain-la-Neuve Belgium Phone: +32 10 47 87 18 Home page: http://inl.info.ucl.ac.be/donnet

2 2

Book on Network Architecture and Design
by MARLON BORBA 03 Dec '07

03 Dec '07

Fellow NANOGers, I am in search of a good book about Network Architecture and Design, with emphasis in Quality of Service and convergent networks, to be used as a reference. Could you please indcate your favorites? -- Abraços, Marlon Borba, CISSP, APC DataCenter Associate Técnico Judiciário - Segurança da Informação IPv6 Evangelist TRF 3 Região (11) 3012-1000 r. 5678 -- Practically no IT system is risk free. (NIST Special Publication 800-30) -- IPv6: só 96 bits a mais (Comitê Gestor da Internet Brasil) --

5 4

Cogent issues in Chicago?
by Brandon Galbraith 03 Dec '07

03 Dec '07

Is anyone else experiencing routing issues with their Cogent connectivity in the Chicago area? Their NOC is aware of it, but was unable to provide any ETR.

1 0